The Enforcement Directorate (ED) searched four premises — three in Bengaluru and one in Madhya Pradesh — as part of an investigation into alleged unauthorised cross-border cryptocurrency transactions. Section 37 of the Foreign Exchange Management Act, 1999 (FEMA), was invoked for these searches, according to the agency’s press release of October 29, which is reproduced in full at the end of this article.
Two sets of entities are named in the release:
- RPFAS Technologies Private Limited, which the ED said operates the platforms Mudrex and Saber.money, and
- Instadapp, a decentralised finance protocol that the ED said now operates largely under the name Fluid.
In a post on X, the ED said the transactions under investigation totalled approximately Rs 5,000 crore. The agency also issued the release in Hindi.
“The probe exposed use of shell entities in tax haven countries, massive OTC deals and illegal foreign payouts via platforms like Binance and Bybit in violation of FEMA provisions,” the post said.
The press release says “further investigation is under progress“, without announcing any arrests, charges or adjudication orders.
What did the ED say about Mudrex and Saber.money?
The ED said its investigation “was initiated based on complaints received alleging large-scale FEMA violations” by RPFAS Technologies. According to the release:
- Payment system: “The discreet enquiries conducted and intelligence gathered by the Directorate revealed the circumvention of FEMA regulations by operation of an unauthorised cross-border payment system using Crypto tokens, especially, stable coins such as USDT/USDC.”
- Advertising: “The entity is openly advertising instant money transfer across borders using cryptocurrencies despite not being authorised with RBI,” the release said, referring to the Reserve Bank of India.
- How it worked: On the basis of “evidences found during the search and statements recorded under FEMA”, the ED said users registered on the platforms and deposited money “in the bank account of the company“. The money was used to buy virtual digital assets, “especially stablecoins such as USDT“, which were then “sold in India on Indian Crypto Exchanges and the sale consideration from the same will be remitted to the receiver”.
- Overseas links: The searches “revealed use of large volume OTC deals, use of shell entities especially incorporated in Canada, Lithuania, USA etc., use of foreign based crypto trading platforms”, the ED said. The release also said the entity traded crypto on foreign platforms “such as Binance, Bybit, etc.”
- Amount: Preliminary findings “revealed contravention of FEMA through unauthorised cross-border money transfer, unauthorised crypto balances in foreign platforms amounting to more than Rs. 4600 Crore“.
One of the advertisements the ED reproduced in its release, a screenshot of Saber.money’s website, states that “Saber is a registered Money Services Business (MSB) in Canada and is registered with the Financial Intelligence Unit of India (FIU-IND), subject to mandatory reporting obligations on fund flows under Indian AML regulations.”
What did the ED say about Instadapp and Fluid?
The ED described Instadapp as “a Defi smart protocol deployed in Ethereum block chain” through which users lend, borrow and swap crypto tokens, and said the platform “started in 2018 now operates largely under the name ‘Fluid’“. According to the release:
- Where it is run from: Although the platform “is shown as run by a US-registered company (Instadapp Labs LLC, Delaware)“, the ED alleged that “it is a paper entity and the founder and the development team work from India”.
- Overseas entities: The ED said the founders operated entities registered in the British Virgin Islands, Singapore and Dubai that “did not have any physical office or employees at their place of registration”.
- Money flow: It alleged that protocol revenue and investor funds were received as stablecoins in wallets “controlled by persons based in India”, sold through two Singapore-based firms, and credited to Singapore bank accounts of group entities. From there, the ED said, the money “was routed to India as remittances for bogus software development and consultancy fees by India Based entities”, and some was routed to the founders’ bank accounts in Dubai.
- Amount: “Preliminary investigations has revealed that contraventions of FEMA, 1999 amounting to USD 40 million (Approx.),” the release said.
What MediaNama has asked the companies
MediaNama has asked RPFAS Technologies:
- Whether it has a response to the allegations in the ED’s press release of October 29, 2026
- Whether it has received any notice or order under FEMA in connection with the searches
- Whether Mudrex users’ funds or services are affected
- Under what regulatory authorisation Saber.money’s cross-border service operates
MediaNama has asked Instadapp:
- Whether it has a response to the allegations in the ED’s press release of October 29, 2026
- Whether it has received any notice or order under FEMA in connection with the searches
- Whether users of the Fluid protocol are affected
Neither company had responded by publication. This story will be updated with any response.
Full text of the ED’s press release
Note: MediaNama has recently received takedown requests concerning its reports on Enforcement Directorate actions. We believe reports on such actions, based on the agency’s own public statements, should remain part of the public record, and so we reproduce the agency’s press release in full below.
The ED’s October 29, 2026, press release is reproduced below in full.
Press Release
29.10.2026
Directorate of Enforcement had undertaken searches in respect of unauthorised cross border remittances using crypto/stable coins. Searches revealed that there is a wide ranging misuse of crypto tokens for unauthorised money transfer and financial transactions.
Directorate of Enforcement (ED), Bengaluru Zonal Office has conducted searches under section 37 of FEMA, 1999 on 27.10.2026 at 03 premises in Bengaluru and one in Madhya Pradhesh on allegation of unauthorized cross-border financial transactions using Crypto especially stable coins.
Mudrex
Enforcement Directorate investigation was initiated based on complaints received alleging large scale FEMA violations by the Bangalore based entity named M/s RPFAS Technologies Private Limited which is operating platforms named “Mudrex” and “Saber.money” using crypto currencies for unauthorised cross border transactions and crypto trading. The discreet enquiries conducted and intelligence gathered by the Directorate revealed the circumvention of FEMA regulations by operation of an unauthorised cross border payment system using Crypto tokens especially stable coins such as USDT/USDC to undertake cross border transfer of money bypassing the authorised channel for cross border money transfer.
The entity is openly advertising instant money transfer across borders using cryptocurrencies despite not being authorised with RBI.
The entity openly advertises on the internet web pages offering services i.e. buying, selling and swapping/converting of crypto immediately / the fastest way to convert fiat to crypto and back for global transfer of money.
The entity offers On-ramp and Off-ramp services of Crypto Currencies i.e. Virtual Assets enabling cross border transfer of money and also converts fiat into Crypto which is delivered cross border.
On-ramp is a service that allows users to convert traditional “fiat” money (like INR, USD, EUR etc.) into virtual digital assets like Bitcoin or stablecoins (USDT) etc.
An Off-ramp is a service to sell virtual digital assets and withdraw the cash back into bank accounts.
A few of the advertisements posted by these entities are as follows:
The release reproduces five screenshots of the Saber.money website here.
On the basis of evidences found during the search and statements recorded under FEMA, 1999, the following modus operandi of cross border transfer of money through VDAs has emerged:
a) Anyone who wants to transfer money has to register on the platforms.
b) The money is to be deposited in the bank account of the company.
c) The money will be used for purchase of VDA, especially stablecoins such as USDT.
d) The VDA will be sold in India on Indian Crypto Exchanges and the sale consideration from the same will be remitted to the receiver.
Investigation has revealed that the entity which is offering cross border transfer of money through VDAs are not complying with any regulation mandated by RBI for inward and outward remittances of funds. Most of these entities are circumventing official channel by operating through related entities registered in foreign jurisdiction and controlled and operated from India. The search operations undertaken by the directorate in the entity revealed use of large volume OTC deals, use of shell entities especially incorporated in Canada, Lithuania, USA etc., use of foreign based crypto trading platforms for unauthorised cross border transfer of money. It is also revealed that the entity is undertaking crypto transactions purchase/sale in foreign based crypto platforms such as Binance, Bybit etc. Huge assets in the form of Crypto are held in the foreign based platforms by the entity in violation of FEMA provisions. The entity is also paying expenses in foreign countries using Crypto in violation of FEMA provisions. Preliminary finding during the investigation has revealed contravention of FEMA through unauthorised cross border money transfer, unauthorised crypto balances in foreign platforms amounting to more than Rs. 4600 Crore.
INSTADAPP – Instadapp is a Defi smart protocol deployed in Ethereum block chain. This provides a platform for decentralised finance using crypto tokens i.e. the Instadapp protocol provides a smart contract for it’s users to undertake lending, borrowing and swapping activities using Crypto tokens. What Instadapp does. Instadapp is a crypto-based “decentralised finance” (DeFi) platform, which works like an online bank that runs on software instead of staff and branches. Users can lend their crypto tokens to earn interest, borrow against crypto they already hold, and swap one token for another, all through automated computer programs called smart contracts. The platform, started in 2018 now operates largely under the name “Fluid”. It earns money from small fees on every loan, borrowing and swap made on it. Open-source data puts the value of crypto held on the platform at more than one billion US dollars, with total fees of about USD 149 million so far. The platform has its own crypto token, which was given to its founders, team and early investors, and which can be sold on crypto exchanges. Although the platform is shown as run by a US-registered company (Instadapp Labs LLC, Delaware), intelligence gathered found revealed that it is a paper entity and the founder and the development team work from India. Intelligence gathered by the Directorate revealed that the entity had routed its money earned from Instadapp Defi protocol through known tax havens such as British Virgin Islands, Singapore, United Arab Emirates etc without complying to the FEMA provisions. Based on the same, a search action was taken under Section 37 of FEMA at 02 Premises in Bangalore and one Premise in Madhya Pradesh. Instadapp/Fluid is projected by the founders as a foreign USA based, decentralised business, but the evidences gathered during the search operations revealed that it is managed from India by Sowmay Jain, one of the founders. The search revealed that founders were operating number of paper entities registered in known Tax Havens i.e. Instadapp Labs Inc (Delaware), Interop Labs Ltd and Summerspeak Ltd (British Virgin Islands), Upsurge Labs Pte Ltd and Bhindi Labs Pte Ltd (Singapore) and Pebble Labs Technology Ltd (Dubai). The search actions revealed that these shell entities did not have any physical office or employees at their place of registration. They are acting as a front for routing the income earned in foreign currency to India. The search operations revealed that the entire defi protocol and associated activities are managed from India. The search operations revealed that the revenue earned from Instadapp Defi Protocol and the funds raised from investors were received as stablecoins in multi-signature wallets of Interop Labs Ltd (BVI). These wallets are controlled by persons based in India. The stable coins were sold in Independent Reserve Singapore and QCP Capital, Singapore, and the fiat proceeds are credited to the Singapore bank accounts of Upsurge Labs Pte and Bhindi Labs Pte which are group entities. From these bank accounts the money was routed to India as remittances for bogus software development and consultancy fees by India Based entities. Also, prepaid cards of Singapore based banks were used in India for making payments for expenses of India based entities. The search action also revealed that the money from Singapore Bank accounts were routed to Dubai bank accounts of founders of Instadapp Defi Platform. Preliminary investigations has revealed that contraventions of FEMA, 1999 amounting to USD 40 Million (Approx.). Further investigation is under progress.
Also read:
